Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder
bit-form · plugin
Known security vulnerabilities for Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder. Find out in seconds which version runs on your site with WP Lens.
21 known vulnerabilities
2 critical · 6 exploitable without logging in · latest Aug 14, 2026
Listed on wordpress.org · latest 3.3.1 · last updated Sep 16, 2026 · 10K+ installs
wordpress.org status checked on Oct 4, 2026
Vulnerabilities
- Critical 9.8
CVE-2025-6679unauthenticated≤ 2.20.3
Contact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload
- Critical 9.0
CVE-2024-7777admin≤ 2.13.9
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administra
- High 8.0
CVE-2024-47319high privilege≤ 2.13.10
WordPress Bit Form plugin <= 2.13.10 - Arbitrary File Upload vulnerability
- High 7.6
CVE-2026-25418high privilege≤ 2.21.10
WordPress Bit Form plugin <= 2.21.10 - SQL Injection vulnerability
- High 7.6
CVE-2024-47335high privilege≤ 2.13.11
WordPress Bit Form plugin <= 2.13.11 - SQL Injection vulnerability
- High 7.5
CVE-2024-13451unauthenticated≤ 2.17.5
Contact Form by Bit Form <= 2.17.5 - Unauthenticated Sensitive Information Exposure
- High 7.2
CVE-2024-7780admin≤ 2.13.9
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administra
- High 7.2
CVE-2024-7702admin≤ 2.13.9
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administra
- High 7.2
CVE-2024-6123admin≤ 2.13.3
Bit Form <= 2.13.3 - Authenticated (Administrator+) Arbitrary File Upload
- High 7.1
CVE-2024-47301unauthenticated · needs a click≤ 2.13.10
WordPress Bit Form plugin <= 2.13.10 - Cross Site Scripting (XSS) vulnerability
- High 7.1
CVE-2026-14372subscriber+≤ 3.1.1
Bit Form <= 3.1.1 - Authenticated (Subscriber+) Arbitrary File Deletion via '_old' Parameter
- Medium 6.5
CVE-2025-14901unauthenticated≤ 2.21.6
Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay
- Medium 6.5
CVE-2026-16810admin≤ 3.2.0
Bit Form <= 3.2.0 - Authenticated (Administrator+) SQL Injection via 'filterText' Parameter
- Medium 6.5
CVE-2024-13450admin≤ 2.17.4
Contact Form by Bit Form <= 2.17.4 - Authenticated (Administrator+) Server-Side Request Forgery
- Medium 6.5
CVE-2024-7782admin≤ 2.13.4
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.4 - Authenticater (Administra
- Medium 5.3
CVE-2024-1640unauthenticated≤ 2.10.1
Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form <= 2.10.1 - Unauthenticated Insecure Direct Object Re
- Medium 4.9
CVE-2025-2580author+≤ 2.18.3
Contact Form by Bit Form <= 2.18.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- Medium 4.9
CVE-2024-9507admin≤ 2.15.2
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.15.2 - Authenticated (Administrator
- Medium 4.8
CVE-2024-7775admin≤ 2.13.9
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administra
- Medium 4.7
CVE-2025-30885unauthenticated · needs a click≤ 2.18.0
WordPress Bit Form plugin <= 2.18.0 - Open Redirection vulnerability
- Medium 4.3
CVE-2024-12190subscriber+≤ 2.17.3
Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder <= 2.17.3 - Missing Authorization to Au
The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).